Layering, OSI and TCP/IP Reference Models

A computer network has to solve many separate problems at once: put bits on a wire, find the boundaries of a frame, detect damaged frames, share a medium, find a path across many networks, deliver data reliably between two programs, and give those programs names and conventions. Layering splits this work into a stack of layers. Each layer offers a service to the layer above, uses the service of the layer below, and talks to its peer layer on the other machine through a protocol.

The payoff is independence. Ethernet can be replaced by Wi-Fi without touching TCP, and a new application protocol can be added without changing any router. The cost is overhead: every layer adds its own header (and sometimes a trailer), and some functions (error control, flow control, addressing) are repeated at several layers.

Two reference models organise the vocabulary. The OSI model has seven layers and is the standard way to name functions. The TCP/IP model describes the protocols the Internet actually runs. Both are used to answer "at which layer does X happen" and "which device works at which layer", and layering also explains header-overhead arithmetic.

None. Binary and hexadecimal notation helps when reading header fields later in the subject.

Service versus protocol. A service is vertical (between adjacent layers on one machine); a protocol is horizontal (between peers on different machines). A layer may change its protocol completely without the layer above noticing, as long as the service stays the same.

Mnemonic (bottom to top): Physical, Data link, Network, Transport, Session, Presentation, Application. Only layers 1 to 3 run in every router; layers 4 to 7 are end-to-end and run only in hosts.

Tanenbaum describes the TCP/IP model with four layers: link, internet, transport and application. Kurose and Ross teach a five-layer Internet stack: physical, link, network, transport, application. The two are the same idea: the OSI session and presentation layers have no separate place, and their functions (encoding, encryption, session handling) live inside applications or libraries such as TLS.

On the sending host, each layer takes the SDU from above, adds its header and passes the result down. On the receiving host, each layer strips its own header, uses a field in that header to decide which upper protocol gets the payload, and passes the payload up. This upward choice is demultiplexing, and every layer has a field for it:

A router receiving a frame strips the link header, reads the IP header, decides the next hop, and builds a new frame with new link-layer addresses for the next link. The IP header travels end to end (typically TTL and checksum change; fragmentation also changes length, offset and MF, and may change copied options/IHL); the frame exists only on one link.

To decide which layer a protocol belongs to, ask which header the protocol's message is carried in and which layer's job it does. A protocol that rides inside UDP or TCP is an application-layer protocol even if its job is to help the network layer.

Let an application message have $M$ bytes and let each of $n$ layers add $h$ bytes of header. The bytes sent are $M + nh$, so the fraction of the transmitted bytes that is header is

and the efficiency (useful fraction) is $1 - f = M/(M + nh)$. The fraction depends on the ratio $M/h$ only, not on the link speed.

When the lower layer has a maximum payload (an MTU), a message larger than the payload is split, and each piece carries the full set of lower headers. With payload limit $P$ bytes per frame for the upper data and per-frame overhead $H$, a message of $M$ bytes needs $\lceil M/P \rceil$ frames and $M + \lceil M/P \rceil H$ bytes in total.

A 500-byte message passes down five layers, each adding a 20-byte header. Bytes sent: $500 + 5 \times 20 = 600$. Header fraction: $100/600 = 1/6 \approx 16.7\%$. Efficiency $5/6$.

1000 bytes of data, TCP header 20 bytes (no options), IPv4 header 20 bytes (no options), Ethernet II header 14 bytes (destination MAC 6, source MAC 6, EtherType 2) and FCS 4 bytes. Segment 1020, datagram 1040, frame 1058 bytes (Figure 2). Data fraction of the frame: $1000/1058 \approx 0.9452$. If the 8-byte preamble and start delimiter are counted as well, the bytes on the wire are 1066 and the fraction falls to $1000/1066 \approx 0.9381$.

A 4000-byte IP payload has to cross a link whose frames carry at most 1480 bytes of IP payload behind a 20-byte IP header (an MTU of 1500). It needs $\lceil 4000/1480 \rceil = 3$ datagrams. The IP header bytes sent are $3 \times 20 = 60$ instead of 20. The exact sizes and offsets of IP fragments are in IPv4 Fragmentation.

A frame from host A to host B crosses two routers. The physical, link and network layers run at both routers; the transport and application headers are read only at A and B. The IP source and destination addresses stay the same on all three links (without NAT); the Ethernet source and destination addresses change on every link.

Common misconceptions.